Following the UK Information Commission’s (ICO) call for evidence on 8 October 2026 on the application of existing UK data protection laws to “agentic AI” systems, David Naylor, Simon Jones and Paul Jinks share headline thoughts on some of the fundamental data privacy questions raised by the use of agentic AI, summarise the key
When discussing artificial intelligence and data governance, the conversation typically focuses on privacy, cybersecurity and regulatory compliance. Increasingly, however, competition regulators are becoming part of that conversation as well.
A recent episode of the Antitrust Amplified podcast explores developments in government antitrust investigations and private litigation across the United States, the United Kingdom and Europe. Among the topics discussed are AI-related competition issues, procurement collusion matters and broader antitrust enforcement trends.
Continue Reading Why Privacy Professionals Should Be Paying Attention to Antitrust Enforcement Trends
The Data (Use and Access) Act 2025 (DUAA)[i] continues to introduce changes to the UK data protection landscape. One of the most visible developments is the formal transition of the UK’s data protection regulator from the Information Commissioner’s Office to the Information Commission[ii].
Despite the legal name change, organisations should not expect
On July 20, 2026, Pennsylvania Governor Josh Shapiro signed into law Senate Bill 992 (“SB 992”), which significantly amends the Pennsylvania Telemarketer Registration Act (the “Act”), 73 P.S. §§ 2241 et seq. The legislation has important implications for companies that engage in telemarketing, SMS/text message marketing, customer outreach campaigns, and other consumer-facing communications with Pennsylvania
When the first state consumer privacy law – California Consumer Privacy Act (CCPA) – passed, it applied to employees, but before it went into effect in 2020, 2019’s Assembly Bill 25 created a temporary exemption. By January 1, 2023, however, the exemption expired and the CCPA applied fully to personal information collected from or about employees and job applicants, including the CCPA’s anti-retaliation and anti-discrimination requirements. Last year, the CCPA’s Automated Decision-Making Regulations were finalized, with some special treatment applied to the HR context, as explained below. Other state legislatures, however, have mostly (but not completely, as discussed below) avoided extending their consumer privacy laws to employees and job applicants.
Continue Reading US Employers Face Evolving State Obligations for Human Resources AI / ADMT Use
In case you missed it, below are recent posts from Privacy World covering the latest developments on data privacy, security and innovation. Please reach out to the authors if you are interested in additional information.
Businesses with websites that employ cookies and other tracking technologies (collectively, “internet tracking technology”) can breathe a partial sigh of relief. The private right of action under the California Invasion of Privacy Act (“CIPA”), relating to violations of Section 638.51 “alleged to arise from conduct occurring on an internet website, online application, or mobile application,” will be eliminated as of January 1, 2027, as Governor Newsom signed SB-690 on September 30, 2026. The law is retroactive and will apply to all pending lawsuits that commenced after January 1, 2025. Only the California Attorney General will be able to bring pen register and trap-and-trace claims related to conduct occurring on websites, apps, and mobile apps.
However, SB-690 is not a total shield to CIPA claims arising from internet tracking technology, as it does not address other CIPA provisions such as wiretapping (Section 631) and eavesdropping (Section 632), which are frequently used by plaintiffs to target common internet tracking technology notwithstanding that these laws predate internet tracking technology and conflict with the way the newer California Consumer Privacy Act regulates them. In Governor Newsom’s signing statement, he specifically called on the California Legislature to address CIPA again next year to address CIPA’s “other decades-old statutes that are also susceptible to abuse by overly aggressive litigants,” while “ensur[ing] a fair balance between protecting private information and preventing rapacious litigation.”
Continue Reading Pen Register and Trap-and-Trace Claims Involving Websites and Apps Restricted to Enforcement by the California Attorney General as Governor Newsom Signs SB-690
State attorneys general are increasingly shaping the regulatory landscape for organizations that rely on technology, data and artificial intelligence. In the latest episode of Squire Patton Boggs’ Antitrust Amplified podcast, antitrust partner Lauren Briggerman sits down with representatives from the California Department of Justice and the District of Columbia Attorney General’s Office to discuss evolving
As privacy regulation, AI governance, and cybersecurity requirements continue to evolve globally, members of Squire Patton Boggs’ Data Privacy, Cybersecurity & Digital Assets team will be speaking on legal developments at several upcoming webinars, conferences, and CLE programs. Explore the events and hot topics below. For many of these programs we can arrange free passes for clients and are noted below. We look forward to connecting with you!
Continue Reading Upcoming Speaking Engagements and CLE Opportunities with the SPB Data Team
As we flagged last month in our mid-year U.S. privacy roundup, the Delaware legislature recently passed House Bill 380 (“HB 380”), which amends the Delaware Personal Data Privacy Act (the “Act”) in ways that impose significant new, and in many ways complex and novel, requirements on controllers, processors and third parties. On September 2, 2026, Delaware Governor Matt Meyer signed House Bill 380 into law and thus amended what was already a fairly strict state consumer privacy law. These amendments significantly lower the volume-based thresholds for applicability, create new obligations for providers of “reports” used to make certain types of decisions and businesses that use that data, add new requirements for consumer rights, impose restrictions on profiling job applicants, employees and independent contractors, and require contracts with and obligations from third parties that receive personal data (e.g., sales), among many other changes. These amendments will become effective on January 1, 2027.
Businesses that are subject to the Act (of which there will be many more as a result of HB 380) should carefully review the amended Act to determine their new obligations, including the significant amendments discussed below. Financial institutions in particular should determine whether they must now comply with the Act, as the broad exemption for financial institutions subject to Title V of the Gramm-Leach-Bliley Act (the “GLBA”) has been replaced by a narrower exemption for only certain types of financial institutions and certain of their affiliates (see discussion below).
Continue Reading Amendments to Delaware’s Consumer Privacy Law Deepen the Morass of State Privacy Regulation